Warning: Citrix ShareFile Flaw Could Let Attackers Steal Corporate Secrets

Since the past few weeks, software giant Citrix has privately been rolling out a critical software update to its enterprise customers that patches multiple security vulnerabilities affecting Citrix ShareFile content collaboration platform. The security advisory—about which The Hacker News learned...

Warning: Citrix ShareFile Flaw Could Let Attackers Steal Corporate Secrets

Since the past few weeks, software giant Citrix has privately been rolling out a critical software update to its enterprise customers that patches multiple security vulnerabilities affecting Citrix ShareFile content collaboration platform. The security advisory—about which The Hacker News learned...

CVE-2019-7218

Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's otp physical token or virtual app like google authenticator is able to bypass the first authentication phase username/password mechanism an...

CVE-2019-7217

Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request to check the otp code. No authentication is required...

CVE-2019-7218

Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's otp physical token or virtual app like google authenticator is able to bypass the first authentication phase username/password mechanism an...

Cross site request forgery (csrf)

Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request to check the otp code. No authentication is required...

Authentication flaw

Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's otp physical token or virtual app like google authenticator is able to bypass the first authentication phase username/password mechanism an...

CVE-2019-7218

Citrix ShareFile vulnerable to a downgrade of authentication from two-factor to one-factor for versions before 19.23. An attacker who has access to the victim’s OTP token or authenticator app could bypass the username/password step and log in with username/OTP only. The issue affects the 2FA logi...

CVE-2019-7217

Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request to check the otp code. No authentication is required...

CVE-2018-16968

Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal...

CVE-2018-16969

Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message...

CVE-2018-16969

Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message...

Directory traversal

Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal...

Design/Logic Flaw

Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message...

CVE-2018-16968

Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal...

CVE-2018-16969

Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message...

CVE-2014-1910

Citrix ShareFile Mobile and ShareFile Mobile for Tablets before 2.4.4 for Android do not verify X.509 certificates from SSL servers, which allow man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...